LiveID Selfie

Configure LiveID Selfie with Push Notification for Windows login in 1Kosmos. Authenticate using facial biometrics and 1Kosmos app approval.

Users provide a live selfie on a camera-enabled device at the Windows login screen. Facial recognition and liveness detection verify the user is physically present. No password is required when LiveID Selfie is configured as the sole authentication method.

Admin Setup

Configure the Authentication Journey

1. In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.

2. Create a new journey or edit an existing one.

3. Under Authentication Method, select LiveID Selfie.

4. To use LiveID Selfie as the sole authentication factor (passwordless), select LiveID Selfie only. To combine with a password, select Password & LiveID Selfie.

5. When LiveID Selfie is configured as the sole factor, users are not prompted for a password at any point in the login flow. Ensure your organisation's security policy permits passwordless authentication before enabling this configuration.

6. Assign the journey to the target user group or machine policy.

7. Save and publish the journey.

Auth Type Configuration

You can configure how the user is prompted for a PIN after a LiveID Selfie capture by setting the authType. This also controls PIN prompts based on whether the device is trusted.

Value	Description
none	Users are never prompted for a PIN.
pin	Users are always prompted for a PIN.
auto	Users are prompted for a PIN only on new devices or untrusted devices. Once a device is marked as trusted, subsequent logins require only the selfie.

User Guide

Login from the User Tile

1. At the Windows login screen, click the 1Kosmos tile.

2. Select LiveID Selfie from the available authentication options.

3. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.

4. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select Trust this device.

5. After successful authentication, you are logged into the workstation.

If you selected Trust this device, subsequent logins from this device require only the selfie — no PIN prompt.

Login from the Other User Tile

1. At the Windows login screen, click Other User.

2. Enter your Windows username and press Enter.

3. Select LiveID Selfie from the available authentication options.

4. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.

5. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select Trust this device.

6. After successful authentication, you are logged into the workstation.

---

LiveID Selfie & Push Notification

Users provide a live selfie on a camera-enabled device and approve the sign-in request via the 1Kosmos mobile app. No password is required when LiveID Selfie & Push Notification is configured as the sole authentication method.

Admin Setup

Configure the Authentication Journey

1. In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.

2. Create a new journey or edit an existing one.

3. Under Authentication Method, select LiveID Selfie & Push Notification.

4. To use this as the sole authentication factor (passwordless), select LiveID Selfie & Push Notification only. To combine with a password, select Password & LiveID Selfie & Push Notification.

5. When configured as the sole factor, users are not prompted for a password at any point in the login flow. Ensure your organisation's security policy permits passwordless authentication before enabling this configuration.

6. Assign the journey to the target user group or machine policy.

7. Save and publish the journey.

Auth Type Configuration

You can configure how the user is prompted for a PIN after a LiveID Selfie capture by setting the authType. This also controls PIN prompts based on whether the device is trusted.

Value	Description
none	Users are never prompted for a PIN.
pin	Users are always prompted for a PIN.
auto	Users are prompted for a PIN only on new devices or untrusted devices. Once a device is marked as trusted, subsequent logins require only the selfie and push approval.

User Guide

Login from the User Tile

1. At the Windows login screen, click the 1Kosmos tile.

2. Select LiveID Selfie from the available authentication options.

3. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.

4. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select Trust this device.

5. A push notification is sent to your 1Kosmos mobile app. Open the app and approve the sign-in request.

6. After successful authentication, you are logged into the workstation.

If you selected Trust this device, subsequent logins from this device require only the selfie and push approval no PIN prompt.

Login from the Other User Tile

1. At the Windows login screen, click Other User.

2. Enter your Windows username and press Enter.

3. Select LiveID Selfie from the available authentication options.

4. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically.

5. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select Trust this device.

6. A push notification is sent to your 1Kosmos mobile app. Open the app and approve the sign-in request.

7. After successful authentication, you are logged into the workstation.